# SureForms <= 2.12.8 - Authenticated (Contributor+) Sensitive Information Exposure via Smart Tags in Post Content

- **ID:** WPSEC-2026-0977
- **Plugin:** SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz (`sureforms`), https://wordpress.org/plugins/sureforms/
- **Affected versions:** all versions before 2.12.9
- **Fixed in:** 2.12.9 (Update to 2.12.9 or later.)
- **Severity:** High 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sureforms
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0977/

## Description

The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure via smart tags in all versions up to, and including, 2.12.8. Smart tags were resolved in any block content rather than only in SureForms forms, and the cookie smart tag could read any cookie of the request, including WordPress login cookies. This makes it possible for authenticated attackers, with Contributor-level access and above, to expose the cookies and account details of users who view their posts, and to place request values into links in those posts.

## References

- https://wpsec.com/vuln/WPSEC-2026-0977/
- https://plugins.svn.wordpress.org/sureforms/tags/2.12.9/
- https://wordpress.org/plugins/sureforms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0977/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.